Privacy Policy

1. Who operates SveLingo

SveLingo is operated by Wenlin Fan, an independent developer based in Linköping, Sweden. For privacy requests, contact privacy@svelingo.com.

2. Data we collect

We collect the minimum data needed to provide Swedish learning features and keep the service reliable.

• Account data: email address, authentication provider details, password hash when password sign-in is used, refresh tokens, and login timestamps.
• Learning data: word progress, session history, review state, streaks, saved words, wordbooks, grammar practice state, and placement or CAT results.
• Search and dictionary activity: search queries, whether a query had results, response timing, and related technical metadata used to improve dictionary coverage.
• Diagnostics and product analytics: route or page events, navigation events, search metadata, audio playback events, login entry or exit events, request status, app version, deployment environment, pseudonymised identifiers, consent state, and error metadata needed for troubleshooting and product improvement.
• Support messages: information you choose to send when contacting support, privacy, or security channels.

3. How we use data

• Provide account access, learning sessions, review scheduling, saved words, wordbooks, and search.
• Maintain service security, detect abuse, debug errors, and measure reliability.
• Improve dictionary coverage, learning flow quality, and product usability.
• Respond to support, privacy, data export, deletion, or security requests.

4. Storage on your device

SveLingo uses browser storage for essential product behavior and preferences.

• Authentication tokens or secure cookies keep you signed in.
• Locale preferences remember your language setting.
• Recent searches, tutorial state, and in-progress practice state improve the local experience.
• A device identifier may be used for authentication, diagnostics, rate limiting, or abuse prevention.
• An analytics consent preference remembers whether optional product analytics are allowed.

We do not use advertising cookies. Cloudflare may use security-related cookies or similar technologies when protecting the service.

5. Diagnostics and analytics

On the web, optional product analytics are used only in production and only after you allow analytics. We use Google Analytics, VibeLoft Web Telemetry, and a self-hosted Rybbit deployment to understand aggregate page visits, geographic distribution, navigation, word search behavior, audio playback, and login flow behavior. The iOS App collects analytics differently, as described below.

Server-side page statistics

To understand which public pages people visit, which pages search engines and AI services fetch, and which visits come from links in AI assistants, our web server counts page requests. This does not use cookies or read anything stored on your device. For each page request it records only: the page address, with session and account identifiers removed; the type of visitor, derived from the user-agent string (for example a known crawler's name, or "browser"); the referring site, if it is on a fixed list of search engines, social networks and AI services; a campaign source from a fixed list; and the response status. It does not record your IP address, your full user-agent string, cookies, account identifiers, or any identifier that could link your visits together. Cloudflare keeps these records for up to three months; we keep only daily totals.

iOS anonymous usage statistics

The SveLingo iOS App collects anonymous product usage events, such as page visits and learning session statistics, to improve the product. These events are collected by default in production builds. No persistent device identifier is written to the device for analytics purposes. Your IP address is not forwarded to the analytics storage; coarse country-level information is derived on the server side from request metadata. Debug and test builds do not send analytics events.

iOS identity-associated analytics

When you are signed in, analytics events may be associated with a pseudonymous analytics identifier derived from your account. This mapping is performed on the server side using a one-way transformation; the iOS App never sends your account identifier in analytics event data. The Settings page provides a "Share Product Analytics" toggle, which is enabled by default. You can turn it off at any time, and when you do, all subsequent events are immediately sent anonymously. Signing out or switching accounts also immediately returns events to anonymous.

Raw search terms are not sent to analytics services. Search analytics events use limited metadata such as query length, result count, and matched dictionary entry identifiers. Signed-in analytics events may include a transformed user identifier so product behavior can be analyzed across sessions without sending email addresses.

Current diagnostics and analytics are pseudonymised, not fully anonymous. Identifiers are transformed before they are written to analytics or diagnostic systems, but they may still be linkable within operational systems.

We do not sell analytics data or use it for advertising. Advertising storage, ad personalization, and ad user data are not enabled for analytics consent.

5a. Android app

The Android app sends a device identifier (ANDROID_ID in X-Device-ID), a random per-install identifier (X-Install-ID), and the app version with every API request. We use these identifiers for authentication, abuse prevention, and app functionality. Account and learning data are handled as described in §§2–3.

The Android app has no analytics or crash-reporting SDK and does not collect an advertising ID. The web and iOS analytics described in §5 do not describe Android app analytics. Data sent to our production service is encrypted in transit using HTTPS. We do not sell Android app data or share it for advertising or cross-app tracking.

Third-party services used by Android are Google Sign-In through Credential Manager and Google Play services for authentication and app functionality, and Cloudflare Turnstile in a WebView only during email sign-up for abuse prevention. Necessary data is processed by these providers to deliver those services. Our infrastructure and operational logging providers are listed in §7.

Daily reminders, when available, are optional local notifications scheduled on your device. On Android versions that require it, the app requests POST_NOTIFICATIONS permission. You can decline or disable notifications; they are not remote marketing messages.

6. AI assistants connected to SveLingo

You can connect SveLingo to an AI assistant such as ChatGPT or Claude. To do so you sign in on svelingo.com and approve the connection; you choose whether to connect, and nothing is shared before you do. Once connected, the assistant can, when you ask it to, look up Swedish words, save words to your Saved Words, and read your study plan for today.

• What SveLingo receives from the assistant: the Swedish words it asks to look up or save, and, for the study plan, the date it asks about. Words saved this way are stored in your account like any other saved word.
• What the assistant receives from SveLingo: dictionary information about the words looked up (part of speech, inflected forms, level, frequency, definitions, examples, and pronunciation audio links); whether you have already saved each word; the result of each save; and today's study plan (reviews due and completed, your new-word goal and progress, estimated minutes left, and your streak). SveLingo does not send the assistant your email address, password, account identifier, or SveLingo sign-in tokens.
• What SveLingo keeps: a record of the connection and the SveLingo sign-in tokens for it, stored encrypted by SveLingo's connection service on Cloudflare. A connection that is not used for 30 days expires and its tokens are deleted. Our servers log request metadata for these calls (which assistant made the request, which feature was used, the result status, and timing), as they do for other SveLingo requests. The connection service does not log the words you look up or save.
• The assistant's provider: what you type to the assistant, and what SveLingo returns to it, is also handled by the assistant's provider (for example OpenAI for ChatGPT or Anthropic for Claude) under that provider's own privacy policy. SveLingo does not control how the provider processes that data.
• Disconnecting: remove SveLingo in the assistant's settings to end the connection. Resetting your SveLingo password or deleting your account also ends every connection.

7. Service providers

We use service providers only to operate, secure, and observe the product.

• Cloudflare: DNS, routing, security, performance protection, and the server-side page statistics described above.
• Datadog: observability, logs, metrics, and reliability diagnostics.
• Google Analytics: consent-based product analytics for page visits, geography, navigation, and interaction events.
• VibeLoft: consent-based product telemetry for product analytics.
• Self-hosted Rybbit: consent-based product analytics operated on SveLingo-controlled infrastructure.
• Infrastructure providers: hosting, database, storage, and deployment services needed to run SveLingo.

8. Retention

Account and learning data are kept while your account is active so the product can preserve progress. Authentication tokens expire or are revoked according to security settings.

Raw search and diagnostic logs should be retained only as long as needed for troubleshooting and product quality, then deleted or converted into aggregate metrics. Analytics event retention is managed through Google Analytics, VibeLoft, and the self-hosted Rybbit deployment. During beta, retention windows may be adjusted as the operational setup matures.

9. Your choices and rights

Delete your account and learning data on our account deletion page or in the app. For access, correction, export, or help with deletion, email privacy@svelingo.com.

Delete your SveLingo account

iOS: Settings → Account & Security → Delete Account.

Android: Profile → Account & security → Delete account.

10. Children

SveLingo is not directed to children under 13. Minors should use the service only with consent from a parent or guardian.

11. Security

We use technical and organizational safeguards appropriate for a free beta product, including HTTPS in production, access controls, token expiry, and diagnostic filtering for sensitive keys. No online service can be guaranteed completely secure.

12. Changes

This policy may change as SveLingo moves from beta to a broader launch. Material updates will be reflected on this page with a new last-updated date.